Hacker News Reader

Comment by Saris | Hacker News Reader

Well, what's the alternative besides a local keepass DB or something?

A local keepass is a great alternative, been doing that for ages and honestly copying my keepass db to a device every once in a while is way less troublesome than quadruple factoring into lastpass/1password or whatever.

For most people, the keepass db will need to be synced and they’ll also want clients on their computers and phones to access it.

What’s the difference, security wise, to an all in one offering that works the same way under the hood, like 1password cloud or bitwarden?

It seems to me that those syncing keepass databases around are just incurring pain without any real increase in security.

Having a different vendor for the frontend software and the cloud storage part does arguably increase security.

Let's say a national security agency wants access to your passwords. They can "easily" make LastPass send a custom version of the client to your browser. This custom version could send your password to LastPass, allowing them to decrypt your database.

To me it seems like it would be harder to ship a malicious KeePass program to a single user. Especially if that user has installed KeePass using their Linux OS package manager.

Syncing is basically painless and automatic with Syncthing[0] - you only need to set it up once per device (unless you are adding devices frequently which isn't the typical usecase for personal use).

[0]: https://syncthing.net/

I use a mental algorithm that generates a unique password for each site. It's easy to remember the algorithm and I get a complex unique password for every site. I don't think a password existing outside of your head makes sense.

(though some sites force unique passwords/and password changes, which can be annoying as I have to remember to bump a value mentally for how many times i've been forced to do it, luckily for the most part it's not an issue)

I see, you left this out of your original post and it would have had me reply entirely different. This certainly can work for you and makes sense, expecting everyone to do this instead of using a tool to do this is unrealistic IMO. Everyone thinks about things differently and many people "dont care" about security and just want a password that works.

That’s great but for 95% of the population they’ll never do that. They’ll come up with a generic low security password that’s easy to both remember and type. And they’ll reuse essentially that same password on every site.

So, for your practices maybe a password manager is a step down. But for 95% of the popular it’s a step up.

Security is a spectrum, and password managers move most people to a more secure stance. You can yell at people that they can be more secure until you’re blue in the face, but most of them will shrug and ignore you.

If this was common, password hackers would encode such algorithms into password hackers, then once your password is leaked from one site,it's game over (I suspect the set of human brain easily executable algorithms isn't that large).

Reply on news.ycombinator.com